ANS-C01 Question 31
Select 2You are designing a secure hybrid network architecture for your company that connects an on-premises data center to AWS using AWS Direct Connect. The on-premises network requires private connectivity to an Amazon VPC and access to public AWS services such as S3 without traversing the public internet. Which configuration should you implement to meet these requirements?
- A
Set up a Direct Connect private virtual interface (VIF) for access to the Amazon VPC and a public virtual interface (VIF) for access to public AWS services.
- B
Use AWS Direct Connect Gateway to connect to multiple VPCs in different regions and route public AWS service traffic through it.
- C
Create a VPC endpoint in the Amazon VPC for access to public AWS services like S3 and route traffic through it.
- D
Configure a Direct Connect private VIF to the VPC and use a NAT Gateway in the VPC to access public AWS services.
- E
Set up a VPN connection over Direct Connect using a private VIF to access both VPC resources and public AWS services.
Show answer and explanation
Correct answers: A, B
Explanation
To securely connect an on-premises network to AWS while accessing both private VPC resources and public AWS services over AWS Direct Connect, you can use a combination of a private VIF (for VPC connectivity) and a public VIF (for public AWS services). AWS Direct Connect Gateway can also be used to simplify connectivity to multiple VPCs across regions and manage routing to public AWS services. Other options, such as VPC endpoints and NAT Gateways, do not fulfill the requirements of the scenario.
- A. Correct.
Correct. A private virtual interface (VIF) provides private connectivity to an Amazon VPC, while a public virtual interface enables direct access to public AWS services such as S3 over the Direct Connect link.
- B. Correct.
Correct. AWS Direct Connect Gateway allows you to connect multiple VPCs in different regions using a single Direct Connect connection. Additionally, public VIF can be used for public AWS services traffic.
- C. Incorrect.
Incorrect. A VPC endpoint provides private access to AWS services from within a VPC, but it does not facilitate access via Direct Connect from an on-premises network.
- D. Incorrect.
Incorrect. A NAT Gateway is used for outbound internet access from a VPC, but it does not provide the private connectivity required for accessing AWS public services over Direct Connect.
- E. Incorrect.
Incorrect. A VPN over Direct Connect is typically used for encryption purposes and does not inherently support access to public AWS services.